Project5 Free container audit

Measurement assurance for GTM & GA4 · Run for you

Find out the day a conversion tag dies.

Every day your Google Tag Manager containers get snapshotted, diffed, and checked against what GA4 actually recorded. When something breaks, you hear from me that day — with the cost attached — instead of finding it at quarter close.

This is a service, not software. I’m Rick. I run the tooling; you get the reports. There’s no dashboard, no seat to buy and nothing to log into — and that’s the point. You’re hiring the person who reads the output, not a login you’ll stop opening in six weeks.

Written for whoever is accountable for containers they did not build: agency principals, fractional analytics leads, and the in-house measurement owner whose last agency just left.

Get the free container audit See a sample audit
Runs
Daily
Covers
GTM + GA4
Access
Read-only to start
Setup
No account, no login
Reports
Yours to forward
Cancel
Any month

Change control

The history exists. You just can’t get at it.

Google Tag Manager’s history exists — and it’s trapped in Google’s console. You can’t diff it as text, export it, alert on it, or read it across more than one container at a time. It doesn’t cover the unpublished workspace. And the day your access to that account ends, so does your history.

So I keep it outside Google. Your container’s full configuration is committed as files you own — every publish a diff, every change reversible in one sentence. Your GTM container, in version control. That record outlives me, the agency before me, and whoever had the login last.

The problem

The container nobody owns is charging you rent.

GTM is where marketing intent meets engineering reality, and in most companies nobody owns that seam. The CMO can’t read the container, the devs don’t care what’s in it, and the agency that set it up left eighteen months ago. Five bills arrive in the post.

Container rot
Zombie pixels from dead campaigns and departed agencies. Nobody deletes them, because nobody knows what’s safe to delete. Your page speed pays the tax on every visit.
Silent data death
A form redesign breaks the conversion tag. Nobody notices for six weeks. A quarter of decisions get made on the corpse of that data. This is the expensive one. Why nothing turns red →
Zero change visibility
Someone publishes, something breaks, and there is no journal anyone can read to find out what happened or when.
Compliance exposure
Pixels firing before consent, and a disclosure list that stopped matching what the container actually loads two agencies ago.
The ticket queue
“Add the LinkedIn tag” takes a sprint. The first and most expensive week of campaign spend goes out unmeasured.

On that fourth line: what Project5 reports about consent is a review of what your container does — which tags declare consent settings, which fire unconditionally, what loads before a visitor has chosen. It is a factual description of a configuration. It is not legal advice, it is not a compliance certification, and it is not a substitute for your own counsel.

What you get

Three things nobody’s GTM setup has today.

Not a dashboard to log into. Three deliverables that land where you already work, each one aimed at a bill above. The change control is the product; the audit is how you find out whether you need it.

01 / The Health Check

Proof your conversions still fire.

Daily verification, backed by the GA4 API, that your key events are still breathing. A flatline or a step-change reaches you the day it’s found, not at quarter close.

And it arrives priced. The gap is measured against a weekday-adjusted baseline and reported in money, with a range and the assumptions printed underneath — because “the tag stopped firing” does not survive a budget review.

Nothing reaches you unread — I look at the run before you do.

KillsSilent data death, in a day instead of a quarter.

02 / Drift Watch

The changelog you never had.

Every readable container snapshotted on a schedule and diffed against the last known good. Changes arrive in plain English — tag modified: firing triggers changed — for every container at once, without opening the console.

Those snapshots are plain files, so your container’s full contents live in git like source: every publish becomes a diff someone can read, and the history is yours to keep.

You get the exceptions. I read the rest.

KillsZero change visibility, including the changes you made yourself.

03 / The Audit — free

A scored report on one container.

Eight categories against any live container — conversion tracking, consent posture, zombie tags, duplicate triggers, performance weight, orphaned entities, version hygiene, naming rot. Client-ready, ranked fixes first, written for the person who approves the work rather than the person who built it.

Agencies charge from about $2,000 for an audit alone. Mine is free for one container, because the audit was never the product — it’s how you find out what shape you’re in, and how I prove I should be trusted with the container.

KillsContainer rot, and the page-speed tax it has been quietly charging you.

Get the free container audit

Read-only. Name a container, get the scored report back.

What arrives when nothing is wrong

Two documents a month, both forwardable.

The month nothing breaks is the month a retainer looks cancellable. So the retainer produces evidence rather than silence: one document says what changed in your container, the other says what it cost the last time something stopped. Both are written for the person who signs the invoice, not the person who built the tag.

New to any of this? Start with how tracking works →

Change report · plain English GTM-WJSNBN47
  • Container version: 5 → 6 (published by unknown — GTM exposes no author).
  • Version 6 is named “Lead conversion (ad-ready)”.
  • Tag “GA4 event — generate_lead” ADDED — GA4 event, fires on generate_lead, requires analytics_storage.
  • Trigger “generate_lead” ADDED — custom event.
  • Variable “dlv - product” ADDED — data layer variable.

Real output from the drift check, run over this site’s own committed snapshot. Version 6 is the change that added the lead measurement on this very page. GTM records no author for a publish, so the line says so rather than inventing one.

Outage impact · priced Alert

purchase was dark for 7 days, 2026-07-27 to 2026-08-02. GA4 recorded 0 against a weekday-adjusted expectation of about 368, a shortfall of about 368 conversions (range 327 to 409). At $38.90 per conversion that is approximately $14,300 in unattributed revenue (range $12,700 to $15,900). Confidence: high.

purchase is a GA4 key event. Key events are what Google Ads imports as conversion actions, so any Ads campaign importing it recorded nothing from it for 7 days.

Printed with it, every time

  • Baseline: per-weekday median of the 21 healthy days from 2026-07-06 to 2026-07-26.
  • Impaired span: the run of days ending 2026-08-02 that stayed under 50% of what that weekday ran at before the outage.
  • Value: $38.90 per conversion, GA4’s own purchase revenue over the 28 complete days before the outage.
  • Range: ±1.645 robust standard deviations, about a 90% band.

Produced by the impact estimator over a demonstration series — a purchase event with an ordinary weekday shape that stops for a week. The arithmetic and the wording are the tool’s; the traffic is not a client’s. Where no value per conversion can be established, the outage comes back as a conversion count and the report says a value was never configured, because a number nobody can defend is worse than no number.

KillsThe renewal conversation where nobody can remember what the retainer did last quarter.

Campaign launch kits

The tags exist before the budget does.

The most expensive week of a campaign is the first one, and it is the week that usually runs unmeasured while a ticket waits in somebody else’s queue. A launch kit collapses that wait into one instruction.

Send one sentence — the campaign name and which tags it needs — and the whole measurement set gets built as a single unit before the budget goes out: GA4, Google Ads and the social pixels, sharing one trigger, every entity named to the same convention so the campaign can be found, audited and pulled out together when it ends.

  • I send you the list before anything exists. A dry run returns the complete kit — every name, every tag type, every consent setting — without calling the API at all. Nothing is created until you have seen the list.
  • It stages, it never publishes. Everything lands in a workspace for review. Going live is a separate step, and you say when.
  • The naming is enforced, not suggested. Two tags that would collide on a name are refused up front rather than discovered halfway through the kit.
Dry run · nothing created yet Summer Sale 2026
  • Trigger [Summer Sale 2026] — CE - generate_lead
  • Tag [Summer Sale 2026] — GA4 - generate_lead
  • Tag [Summer Sale 2026] — Google Ads - Conversion - AW-123456789/abcdEFGHijkl
  • Tag [Summer Sale 2026] — LinkedIn - Insight Tag

Everything fires on the shared trigger except the LinkedIn base pixel, which keeps All Pages — a template’s own default wins, and the preview tells you where that happened.

KillsThe ticket queue — measurement is in place before the spend starts, not a fortnight after it.

Measurement plan as code

The answer to “do we track that?” is a diff.

Every company has a document that says what it is supposed to measure. It is a spreadsheet, it is out of date, and nobody has held it against the live container in a year. I keep it as a file that lives beside your container, and the comparison stops being a meeting — it’s a diff you get back.

Plan · plans/GTM-WJSNBN47.json GTM-WJSNBN47 Satisfied
  • Requires Google tag · G-TWZX6SCSWQ Satisfied by tag 3 “GA4 — project5.ai”
  • Event cta_click · ga4-event Satisfied by tag 6 “GA4 event — cta_click”, firing on trigger 5 “CTA click”
  • Forbids Custom HTML In the container: none — and nothing the plan does not account for

Real output, run against this site’s own container and the plan committed beside it. Reconciling reads GTM and the file and writes nothing to either.

Satisfied
The entry names the tag that answers it and the trigger it fires on. Matching is on outcome, not provenance — a tag somebody built by hand in the console counts, so long as the values that identify it agree.
Missing
Nothing in the container answers the entry, so the report hands back the exact call that would create it, arguments filled in and ready to run. Building it is still your decision.
Mismatched
The tag exists but a value it is identified by differs. Both values are shown and no create call is offered, because the fix is to correct that tag rather than stand a second one up beside it.

KillsCompliance exposure — the half of it that is a list. Every tag in the container is either one you declared or one the report hands back to you by name.

Pricing

The audit is free. The change control is the product.

Start with the audit at no cost, take the fixes as a fixed-scope project if you want them, then keep the container honest on a retainer priced by how many containers you run. Request any of them in one field — you get a scope and an invoice back, and never a sales call.

01 / Diagnose

Free

Container Audit

Know exactly what is in your container — scored across eight categories, with the fixes ranked first.

Free One container · by request
  • Read-only access to your GTM account — nothing is written.
  • The scored report: zombie tags, consent posture, duplicates, performance weight, naming, versioning, orphans.
  • Ranked fixes first, in a client-ready HTML report.
  • A 30-minute walkthrough of the findings — a delivery call, not a sales call. Want the report and nothing else? Say so and I won’t chase.
Request the audit

Ask with the form below; I run it and send the report back.

02 / Fix

Setup & Remediation

Fix the findings and stand up ad-ready conversion tracking, so your ad spend is measurable and optimizable.

$3,500 One-time project · 1–2 weeks
  • Everything in the Container Audit.
  • Zombie tags removed; Consent Mode v2 wired correctly.
  • Broken conversion tags repaired.
  • Ad-ready GA4 key events, importable into Google Ads so spend is measurable and optimizable.
  • The versioned measurement plan, handed over reconciling green.
  • $5,000 where consent and CMP work is in scope — that is where the job is genuinely open-ended.
Request the setup

Scope and invoice by email.

03 / Maintain

Run for you

Monitoring

Catch the day a conversion tag stops firing — not at quarter close — and keep a history somebody can read.

$249/mo From · priced by containers
  • Daily conversion-health check and drift watch.
  • The monthly change report in plain English.
  • An alert the moment a key tag breaks, priced against a weekday-adjusted baseline.
  • A re-audit every quarter.
  • You’ll never pay per alert, per report or per request. Charging for those would make you ration the one thing you’re buying.
Request monitoring

Tiers below. Scope and invoice by email.

Monitoring, priced by containers

Solo

$249/mo

1–3 containers

Studio

$600/mo

Up to 10 containers

Agency

$1,500/mo

Up to 25 containers, white-label — what agencies get

Fleet

Custom

25+ containers

  • Every tier is the same service. The container count is the only difference — no feature is held back for a higher tier, except white-label reporting, which only means anything above one client.
  • The retainer covers daily monitoring, the monthly change report, the quarterly re-audit and the small changes that come up. A rebuild is a project, quoted separately.
  • Annual prepay is ten months for twelve on every retainer tier.

Every engagement is request → scope → invoice → deliver. I do the work; you get the artifact. The request form below posts to my own server on my own domain — no third-party form processor, no marketing automation platform, and no sales call to book.

Proof

I point it at myself first.

I don’t sell tag hygiene I haven’t lived. Everything on this list is visible from where you are standing:

  • This site is instrumented by Project5 itself. Its GTM container was created by the tooling, not by hand in the GTM console — and the button you are about to click is measured by it. Every CTA on this page fires a cta_click event through a tag Project5 authored from its own templates, shipped as the container version named CTA conversion measurement. Decline the banner and that click never leaves your browser.
  • My own conversion is watched by the same health check. cta_click is a key event in GA4, and the conversion-health check reads whatever a property has marked as a key event — so it picked mine up without being told to, exactly as it would yours.
  • The consent stack you just met is the one I’d ship you. Consent Mode v2 denied by default in the document head, zero off-origin requests before you say yes, Global Privacy Control honoured, Accept and Decline given equal weight, and a withdrawal that purges the cookies rather than merely remembering you asked.
  • Drift watch runs on my own containers on a daily schedule — the same routine, on the same code path, that I would point at yours.

The tooling caught its owner

On 2026-08-08, drift watch read a GA4 tag I had created hours earlier and reported it back to me: added — fires on all pages, no consent settings declared. I declared them and republished. The next run narrated that fix too. I would rather show you that than a testimonial.

The loop is verified live, end to end:

tag authored published fired in a real browser numbers read back via API

Straight answers

What this is, and what it isn’t.

There is no self-serve version, and there won’t be one soon
No signup, no installer, no seat. Everything on the price list is me running the tooling and sending you the result. If a product you can log into is what you’re shopping for, I’m the wrong vendor and it’s cheaper for both of us to know that now.
One person runs this
That’s an advantage at your scale and a risk at someone else’s. You get a senior operator reading your containers instead of a junior working a checklist; you don’t get a support rota. Ask me where the queue is before you sign — I’ll tell you.
No case studies yet
No client logos, and I’m not going to borrow any. What I have instead is the tooling pointed at my own containers, with the findings published above.
No dashboard, on purpose
The report, the alert and the git history are the interface.
73 /100 C

8 categories
15 findings
GTM-W44B54PP

The deliverable

See what lands in your inbox.

A scored report with the ranked fixes first, written for the person who has to approve the work rather than the person who built the container. The one below is real output from the audit tool, run against a demonstration container I seeded with the rot I typically find — not a mock-up, and not a client’s data.

See a sample audit

Start here

Name a container. Get the free audit back.

Read-only: nothing is written to your container unless you later name it on the allowlist yourself. One field is required — the address the report should go to.

Before you ask

What “read-only access” actually means

What you grant
One Google service-account address, added under Admin → User Management on the container, at GTM’s Read permission level. Two screens, about a minute. I send you the exact address when I reply — there is nothing to add before then.
Why I cannot write
GTM’s Read role carries no write capability at all, and that is enforced by Google rather than by me. Separately, my own write path checks an allowlist that is empty by default and refuses anything not named on it before it calls the API. Your container is not on that list, and an audit never asks it to be.
What I do with it
Read the container’s configuration, score it, and send you the report. It is not shared with anyone, and nothing about your container gets published — not as a case study, not anonymised.
How you revoke it
The same screen you added it on: remove the row. It takes effect immediately and needs no notice to me. Doing it the moment the report lands is completely fine.
  • It goes to my server, not a form vendor. This form posts to project5.ai. No HubSpot, no Typeform, no marketing automation platform, and no tracking pixel on the submit.
  • No call to book. The audit comes back as a report; anything you go on to buy comes back as a scope and an invoice. If a conversation helps, you ask for one.
  • I keep what you type and the request’s IP address — to answer you and to stop abuse of this form, and nothing else. The Privacy Policy says exactly what and for how long.

Would rather just send an email? That still works: rick@project5.ai.

Where the container runs. It tells me which tags to look at first.

If you already know it. I can find it from the URL otherwise.

No account needed. No sales call. No third-party processor.

This form needs JavaScript to post to my server, and your browser has it switched off — which is a preference I am not going to argue with.

Email rick@project5.ai with the container or the site URL you want read, and you get the same report back.